CVE-2024-5765

Critical · 9.8

CVSS

9.8

EPSS

27.2%

Published

Jul 30, 2024

CISA due date

—

The record

The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

Affected packages

Ecosystem	Package	Introduced	Fixed